[leftmargin=*,nosep]
Auxiliary dataset. We use the train split of CIFAR10 as the auxiliary dataset for training the inversion model \(g_{\theta }\)  and the test split for inverting gradients computed on the global model \(f_{\mathbf {w}}\) .

Inversion model architecture. We use a three-layer MLP with hidden size 3000 for our inversion model \(g_{\theta }\) .
The MLP takes the flattened gradient vector as input and outputs a 3072-dimensional vector representing the flattened image.
The training objective \(\ell ^{attack}\)  in eq:obj is the mean squared error (MSE) between the output vector from MLP and the flattened ground truth image.

Training details. We use the Adam [1]} optimizer for training \(g_\theta \) . The model is trained for 200 epochs using training batch size 256. The initial learning rate is \(10^{-4}\)  with learning rate drop to \(10^{-5}\)  after 150 epochs.

Computation cost. Our experiments are conducted using NVIDIA GeForce RTX 2080 GPUs and each training run takes about 1.5 hours.

